DEA-C01 Data Security and Governance Practice Test 21 — 15 Questions

Question 1

A company needs to audit all API calls made in their AWS account, including actions performed by the root user. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made in an AWS account, including root user actions, for auditing and compliance. Option A is incorrect because VPC Flow Logs capture network traffic metadata, not API calls. Option C is incorrect because Amazon CloudWatch Logs stores log data but does not natively capture API calls; it can ingest logs from other sources. Option D is incorrect because AWS Config tracks configuration changes to AWS resources, not API calls.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 2

A data engineer needs to encrypt data at rest in an Amazon Redshift cluster. The company requires that the encryption key be managed by the customer and rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with automatic key rotation enabled.. AWS KMS with a customer-managed key (CMK) allows you to control the encryption key and enables automatic annual rotation. Amazon Redshift natively integrates with KMS for encryption at rest, making this a straightforward solution. Option D is incorrect because CloudHSM is not directly integrated with Redshift for encryption at rest; it requires custom configuration and is typically overkill for the requirement of annual rotation. Option A is incorrect because SSE-C is used for S3 objects, not Redshift. Option B is incorrect because Secrets Manager is designed for secrets like database credentials, not for encryption keys used by Redshift.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use AWS Secrets Manager to store the encryption key and configure Redshift to reference it.

Answer

Use AWS CloudHSM to create and manage the encryption key, and configure Redshift to use it.

Question 3

A company wants to grant read-only access to an S3 bucket for a data analyst. The analyst should be able to list objects and read object content. Which IAM policy effect and action combination is correct?

Accepted Answer

Effect: Allow, Actions: s3:ListBucket, s3:GetObject. S3:ListBucket allows listing objects in the bucket, and s3:GetObject allows reading object content. This combination provides read-only access. Option A is incorrect because s3:DeleteObject grants delete permissions. Option B is incorrect because s3:ListAllMyBuckets lists all buckets, not bucket contents. Option C is incorrect because s3:PutObject grants write access.

Answer

Effect: Allow, Actions: s3:GetObject, s3:DeleteObject

Answer

Effect: Allow, Actions: s3:ListAllMyBuckets, s3:GetObject

Answer

Effect: Allow, Actions: s3:PutObject, s3:GetObject

Question 4

A company is using Amazon EMR with Kerberos authentication. They want to ensure that data in transit between EMR cluster nodes is encrypted. Which configuration should be applied?

Accepted Answer

Configure the EMR cluster to use in-transit encryption.. Enabling in-transit encryption in Amazon EMR uses TLS to encrypt data between nodes, ensuring data in transit is encrypted. Option A is incorrect because VPC peering does not provide encryption; it is a network connectivity feature. Option C is incorrect because S3 server-side encryption encrypts data at rest, not in transit. Option D is incorrect because EBS encryption encrypts data at rest.

Answer

Use VPC peering to connect the cluster nodes.

Answer

Enable S3 server-side encryption for the cluster's output data.

Answer

Enable EBS encryption on the cluster instances.

Question 5

A data engineer needs to store sensitive data in Amazon S3 and automatically classify the data using a managed service. The data is uploaded via an S3 bucket. Which AWS service can automatically detect and classify sensitive data?

Accepted Answer

Amazon Macie. Amazon Macie is the correct answer because it is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, monitor, and protect sensitive data in Amazon S3. Option B, AWS WAF, is a web application firewall for protecting web applications, not for data classification. Option C, Amazon Inspector, is an automated vulnerability management service for EC2 instances and containers, not for S3 data classification. Option D, AWS Shield, is a managed DDoS protection service, unrelated to data classification.

Answer

AWS WAF

Answer

Amazon Inspector

Answer

AWS Shield

Question 6

A company is using AWS Lake Formation to manage permissions on a data lake. They want to grant a data scientist the ability to query tables in the 'analytics' database using Amazon Athena, but prevent them from accessing the underlying S3 data directly. What is the best way to achieve this?

Accepted Answer

Grant SELECT permission on the 'analytics' database tables in Lake Formation.. Lake Formation grants SELECT permission on named database tables, which allows querying via Athena without granting direct S3 access. Option A is incorrect because granting s3:GetObject on the entire bucket would allow the data scientist to bypass Lake Formation and access the data directly. Option C is incorrect because a policy that allows Athena queries only does not grant the necessary permissions to access the database tables. Option D is incorrect because adding the user to a data lake location with read access is too broad and would also grant direct S3 access, which does not meet the requirement of preventing direct S3 access.

Answer

Grant the data scientist an IAM policy with s3:GetObject on the S3 bucket.

Answer

Create an IAM policy that allows Athena queries only.

Answer

Add the data scientist to a Lake Formation data lake location with read access.

Question 7

A company is designing a data pipeline using Amazon Kinesis Data Streams. The data includes personally identifiable information (PII). The security team requires that data be encrypted at rest using a customer-managed KMS key. How should the data engineer configure the Kinesis stream?

Accepted Answer

Enable server-side encryption on the Kinesis stream and specify the customer-managed KMS key.. Kinesis Data Streams supports server-side encryption (SSE) using AWS KMS. By enabling SSE and specifying a customer-managed KMS key, the data is encrypted at rest. Option A is incorrect because CloudHSM is not used for Kinesis encryption. Option C is incorrect because storing encrypted data in S3 and streaming keys is not a direct encryption method for the Kinesis stream. Option D is incorrect because client-side encryption is an alternative, but the question specifically requires encryption at rest using a customer-managed KMS key, which is achieved via server-side encryption on the stream itself.

Answer

Configure the Kinesis stream to use AWS CloudHSM for encryption.

Answer

Store the encrypted data in S3 and use Kinesis to stream the S3 object keys.

Answer

Use client-side encryption in the producer application to encrypt data before sending to Kinesis.

Question 8

A company wants to use AWS CloudTrail to monitor data events for an S3 bucket. Which TWO configurations are required to capture object-level API operations?

Accepted Answer

Configure the CloudTrail trail to log data events for the S3 bucket.. And Option D are correct. To capture object-level API operations for an S3 bucket, you must configure the CloudTrail trail to log data events for the bucket (Option A). Additionally, the CloudTrail trail must be created in the same AWS Region as the S3 bucket (Option D) because CloudTrail trails are region-specific. Option B is incorrect because management events capture bucket-level operations, not object-level. Option C is incorrect because S3 server access logs are a separate logging mechanism, not part of CloudTrail. Option E is incorrect because CloudWatch Events is not required for CloudTrail to capture events.

Answer

Enable management events in the CloudTrail trail.

Answer

Enable S3 server access logs on the bucket.

Answer

Set up an Amazon CloudWatch Events rule to capture S3 events.

Question 9

A company is using AWS KMS with customer-managed keys to encrypt data in Amazon RDS. The security team wants to ensure that the key can be rotated automatically every year. Which THREE steps are required to achieve automatic key rotation?

Accepted Answer

Enable automatic key rotation in the KMS key configuration.. Options B, C, and D are correct. To enable automatic rotation for a customer-managed KMS key, you must enable rotation via the KMS console or API (B), ensure the key is a symmetric key (C) as asymmetric keys do not support automatic rotation, and configure the RDS instance to use the key (D) for encryption. Option A is incorrect because rotation can be enabled for existing keys. Option E is incorrect because CloudHSM is not involved.

Answer

Migrate the key to AWS CloudHSM.

Answer

Create a new KMS key and configure RDS to use it.

Question 10

A data engineer needs to monitor and log changes to IAM policies in an AWS account. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all IAM API calls, including policy changes. Amazon CloudWatch Logs can be used to store, monitor, and alert on these log events. Option A (GuardDuty) is a threat detection service, not for logging policy changes. Option B (AWS Config) tracks resource configuration changes but not API calls directly. Option C (VPC Flow Logs) captures network traffic, not IAM activities. Therefore, the correct combination is D and E.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

VPC Flow Logs

Question 11

A company stores sensitive customer data in an Amazon S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Additionally, they want to ensure that the encryption context is enforced for all PutObject requests. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS with the desired KMS key.. To enforce SSE-KMS and encryption context, three steps are needed. First, set default encryption on the bucket to SSE-KMS with the desired KMS key (A). Second, add a bucket policy that requires the s3:x-amz-server-side-encryption-aws-kms-key-id header and the kms:EncryptionContext condition key (B). Third, ensure the IAM role used by applications has kms:GenerateDataKey and kms:Decrypt permissions for the KMS key (E). Option C (SSE-C) is incorrect because it uses a customer-provided key, not KMS. Option D (versioning) does not enforce encryption context.

Answer

Configure the bucket to use SSE-C and provide the encryption key.

Answer

Enable S3 Versioning on the bucket.

Question 12

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest and in transit. Which TWO configurations are required to meet these requirements?

Accepted Answer

Enable encryption on the Redshift cluster using AWS KMS.. To encrypt data at rest in Amazon Redshift, you must enable encryption on the cluster using AWS KMS (Option A). To encrypt data in transit, you must configure the cluster to require SSL connections (Option B). Option C (CloudHSM) can be used for key management but is not a required configuration. Option D (VPC Flow Logs) captures network metadata and does not encrypt traffic. Option E (EBS encryption) is not applicable to Redshift's managed storage.

Answer

Use AWS CloudHSM to manage encryption keys for Redshift.

Answer

Enable VPC Flow Logs on the Redshift subnet.

Answer

Enable EBS encryption on the Redshift cluster nodes.

Question 13

A company runs a data lake on Amazon S3 with AWS Glue and Amazon Athena. The security team recently ran a report using Amazon Macie and found that multiple S3 objects containing PII are publicly accessible. The data engineer is tasked with remediating this issue immediately. The S3 bucket is configured with a bucket policy that grants public read access to all objects. The data engineer needs to ensure that no objects are publicly accessible while maintaining the ability for authorized IAM users and roles to access the data via Athena. The bucket must also remain accessible to the Glue crawler. What is the MOST effective course of action?

Accepted Answer

Remove the bucket policy granting public access and attach an IAM policy to the Glue and Athena roles to allow access to the bucket.. The most effective because it removes the public access grant while using IAM policies to authorize only the necessary roles (Glue and Athena). Option A is incorrect because Amazon Macie only identifies PII and cannot remediate access controls. Option C is insufficient because setting the bucket ACL to private does not change existing object ACLs that may grant public access, and using a bucket policy alone does not address object ACL overrides. Option D is incorrect because S3 Block Public Access prevents all public access but using service principals (like the Glue or Athena service principal) is not appropriate for intra-account access; IAM roles must be used to allow authorized users and services.

Answer

Use Amazon Macie to automatically remediate the public access by updating the object ACLs.

Answer

Set the bucket ACL to private and add a bucket policy that allows access to the Glue crawler and Athena.

Answer

Enable S3 Block Public Access on the bucket and use a bucket policy to allow access from the Glue and Athena service principals.

Question 14

A company uses Amazon RDS for MySQL to store application data. The security team requires that all database credentials be rotated automatically every 90 days. The data engineer needs to implement a solution that minimizes operational overhead. The database credentials are stored in AWS Secrets Manager. The application retrieves the credentials at startup and caches them for the duration of the session. The application is deployed on Amazon ECS with Fargate. Which solution should the data engineer implement to meet the rotation requirement with minimal overhead?

Accepted Answer

Use Secrets Manager's automatic rotation feature with a custom Lambda function that updates the RDS password.. Secrets Manager's automatic rotation feature, combined with a custom Lambda function to update the RDS password, provides a fully automated, low-overhead solution. Option A is incorrect because Parameter Store does not natively support automatic rotation and would require additional automation. Option C is incorrect because it involves manual steps to update the application configuration, increasing operational overhead. Option D is incorrect because IAM database authentication does not rotate credentials automatically and would require significant application changes.

Answer

Store the credentials in AWS Systems Manager Parameter Store and use a scheduled job to update the password.

Answer

Create a scheduled Lambda function that updates the password in Secrets Manager and manually updates the application configuration.

Answer

Configure IAM database authentication for the RDS instance and update the application to use IAM credentials.

Question 15

A company is using Amazon S3 to store log files. The security team wants to ensure that any object uploaded to the S3 bucket is automatically scanned for malware before being processed by downstream applications. The data engineer needs to implement a solution that integrates with AWS services and minimizes latency. The bucket receives thousands of objects per day. Which solution should the data engineer use?

Accepted Answer

Enable Amazon GuardDuty with malware protection for S3.. Amazon GuardDuty has a malware protection feature that can scan S3 objects for malware upon upload. It integrates with S3 events and minimizes latency. Option A is incorrect because Amazon Macie is for sensitive data discovery, not malware. Option C is incorrect because AWS WAF is for web application firewall, not S3 scanning. Option D is incorrect because running a custom scanning solution on EC2 adds operational overhead and latency.

Answer

Deploy an EC2 instance with antivirus software that triggers on S3 events.

Answer

Use AWS WAF to inspect objects as they are uploaded.

Answer

Enable Amazon Macie on the S3 bucket to detect malware.